Tell me more ×
Web Applications Stack Exchange is a question and answer site for power users of web applications. It's 100% free, no registration required.
up vote 5 down vote favorite

I got 3 mails from Gmail today; one each for my 3 seperate Gmail accounts, saying someone from this IP: 109.200.4.130 tried to log-in and it was prevented, and that I should reset my password by following the given link if I don't recognize the address.

Is it real or is it phishing? Is this because I signed into one of Gmail accounts with a VPN? But then again why would I get notices for the other two?

share|improve this question
Instincts say phishing. If you are concerned you should go to google.com (manually) and change it. – Rig May 8 '12 at 0:48
I think GMail shows an alert when you log in. I don't recall receiving an email last time I was affected. See: support.google.com/accounts/bin/… – iglvzx May 8 '12 at 0:53
Attach the complete email header and the complete contents of the e-mail; we can tell you various ways to identify fraud emails. – user221287 May 8 '12 at 8:31
1  
This seems to be legit.. techie-buzz.com/online-security/… – Sathya♦ May 8 '12 at 18:12
I doubt this is legit, too. I started receiving this message couple of weeks ago and now receive it 1-3 times a week. The message never specifies which of my google accounts is in question either. I find it hard to believe that all of a sudden people are trying to log in to either of my google accounts, several times a week, on the other side of the world. – user21170 Jun 16 '12 at 6:17
show 1 more comment

migrated from superuser.com May 8 '12 at 1:17

8 Answers

up vote 8 down vote accepted

I am the Gmail Community Manager, and I can confirm that we do send email notifications in certain cases such as described here.

Always carefully check the URL and never enter your Google password on a page that is not hosted at google.com. For example, it is OK to enter your password at https://accounts.google.com or https://mail.google.com, but not gooogle.com, g00gle.com, etc.

share|improve this answer
5  
If a user receives such an email, does that mean the sign-in attempt at the suspicious address was made with the correct password? Or merely that a sign-in was attempted, which could have been with some random incorrect guess at the password? – JasonPlutext Jun 10 '12 at 0:35
I received this google email. It does not provide sufficient information, just a date and location. It doesn't say if there was a third-party app (like dropbox) trying to make the login, or if the user actually knew my password or not. Etc. Not enough information to go on. Bad email. – sbwoodside Jan 14 at 2:27
up vote 3 down vote

I would never follow a link in an email to reset a password, where said reset page asked for my original password.

As for Google, I have never seen any such email, and frequently log into many accounts behind various VPNs in various locations. Where I to receive such an email I would consider changing my password, but would only do so by going directly to Google, not by following such a link.

Did the page also ask for your SSN, mothers maiden name, bank account number for verification of course?

share|improve this answer
1  
Never clicked on the link. – verve May 8 '12 at 1:07
up vote 2 down vote

I've logged in from multiple locations and I have only once been warned that my account may be compromised. Google does not send emails for these at all (see support page). For me it came up as a little warning message at the top. I would highly suggest not following the link given in the email!

share|improve this answer
up vote 1 down vote

The email was legit but I still won't click links from emails like that. When I signed into gmail, a notice was waiting with the same message, on a highly visible red background, and I went in and changed the pw manually. As long as you stick with known URLs, you shouldn't have a problem. I'm glad Google is doing a good job with this. It's not their fault that every email should be viewed suspiciously. If it's real, it will probably be made known to you in more than one way.

share|improve this answer
up vote 1 down vote

I just received an email of this type, and in this case its definitely a fishing attempt. The URLs in the message body do all point to valid Google resources, but the attached 'report' on the problem contains a single file Google_Accounts_Alerts.exe, with a SHA1 of e1e52935037f8d995436015774dfad413966cb57.

Cisco has a recent report on these emails, though they don't reveal the specific nature of the threat: http://tools.cisco.com/security/center/viewThreatOutbreakAlert.x?alertId=26753

share|improve this answer
up vote 0 down vote

Received same email. Interesting part is that I received the email in the evening on May 7. The 'suspicious activity' noted in the email supposedly occured May 8 in the early morning. Good indicator it is spam or Google can now see into the future. Also, the links in the email itself are good spam indicators.

Here is the content of the email I received:

Someone recently tried to use an application to sign in to your Google Account, xxxxxx@gmail.com. We prevented the sign-in attempt in case this was a hijacker trying to access your account. Please review the details of the sign-in attempt:

May 8, 2012 2:59am GMT
IP Address: 204.15.240.72
Location: Sunnyvale, California, United States

If you do not recognize this sign-in attempt, someone else might be trying to access your account. You should sign in to your account and reset your password immediately. Find out how at http://support.google.com/accounts?p=reset_pw

If this was you, and you want to give this application access to your account, complete the troubleshooting steps listed at http://support.google.com/mail?p=client_login

Sincerely,
The Google Accounts Team

© 2012 Google Inc. 1600 Amphitheatre Parkway, Mountain View, CA 94043

You have received this mandatory email service announcement to update you about important changes to your Google product or account.

share|improve this answer
1  
Is it possible that you are in different time zone and that is why your local date/time is different? They sent the time in GMT. – Tschareck May 8 '12 at 14:10
up vote 0 down vote

It appears to be legit. I looked at the routing address and they are all Google.com addresses and if you do the date and time conversion from GMT to local time it is correct.

I am in agreement with everyone else to take this a a good notice, and to manually type in the URL for Gmail and change the password there.

share|improve this answer
up vote -2 down vote

I'm sure that is not legitimate. If you are concerned, go to your accounts themselves and change your passwords there. DO NOT FOLLOW THOSE LINKS.

share|improve this answer
Ya, changed them manually. I can't believe someone found all 3 of my Gmail addresses of mine to spam to!? How did they know? – verve May 8 '12 at 1:09
There are all sorts of spyders searching for email addresses. – Xavierjazz May 8 '12 at 1:10

protected by Community♦ Aug 31 '12 at 8:34

This question is protected to prevent "thanks!", "me too!", or spam answers by new users. To answer it, you must have earned at least 10 reputation on this site.

Not the answer you're looking for? Browse other questions tagged or ask your own question.